
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
The hard working, opinionated build toolset for javascript applications, with pluggable opinions
eilos makes it easy to use and maintain the lifecycle operations of your node project while keeping the amount of dependencies and configuration you need to a minimum.
It is heavily inspired by aegir, but is focused more on the versatility of the "opinitions" rather than forcing a specific paradigm to the user.
Right after you have configured your node module, do the following:
eilos to your dependencies:yarn add -D eilos
yarn add -D eilos-preset-typescript
eilos for every life-cycle script on your project:{
"scripts": {
"build": "eilos build",
"dev": "eilos dev",
"test": "eilos test",
"lint": "eilos lint",
}
}
eilos aims to minimise the amount of configuration required by assuming some deafults.
The base package has no configuration options. They are all provided by the preset you are using.
For example, when using the eilos-preset-typescript preset:
src/index.tsstatic/build/You can override these defaults by providing a .eilos.js configuration file:
/** @typedef { import('eilos-preset-typescript').UserConfig } UserConfig */
/**
* @type {UserConfig}
*/
module.exports = {
// Define the entry point
entry: "src/index.js",
// Define thestatic files
staticSrcDir: "static",
// Manually override specific configuration options for the packages used
// by the profile (refer to the profile documentation)
webpack: {
// Webbpack options
},
typescript: {
// Typescript compiler options
},
jest: {
// Jest options
},
prettier: {
// Prettier options
}
}
Refer to the Preset Development Tutorial to learn how to define your own preset.
FAQs
Web App Build Abstraction
We found that eilos demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.